DTAC, DCB0129, DCB0160 and DSPT: what UK software suppliers need before selling to the NHS (2026)

What UK suppliers need before selling software to the NHS: DTAC v2.0, DCB0129/DCB0160, Clinical Safety Officer, DSPT, device rules and UK GDPR.

Short answer. To sell health software to the NHS in England, a supplier is usually asked for four things: a completed DTAC form (version 2.0 since 6 April 2026), clinical safety evidence under DCB0129 with a named Clinical Safety Officer, a DSPT assessment at Standards Met or Exceeded if you touch NHS patient data or systems, and, if the software has a medical purpose, UK medical device registration. The NHS organisation that deploys your product then carries its own duties under DCB0160.

This guide is written for the supplier side: founders, product owners and CTOs of healthtech companies. It sets out what each requirement is, what the buyer will ask to see, and where the evidence comes from. Every regulatory statement links back to an official source listed at the end of the page. Rules change, so check the current text before you submit anything. This is not legal or regulatory advice.

What do you need before selling to the NHS?

Sources: NHS England DTAC pages and DTAC form v2.0, NHS England digital clinical safety assurance guidance, DSPT help pages, MHRA and GOV.UK guidance. Full list at the end of this article.

Is your product in scope, and is it a medical device?

Start here, because the answer decides which of the other steps apply.

DTAC covers software, including mobile or web applications and software as a service, that is designed or marketed to improve health outcomes or how the health and care system functions. That includes apps people use to manage their own health, and tools for scheduling or digital referrals. It does not cover firmware or software embedded in hardware devices such as scanners, and it is not meant for products not marketed for health or care, such as HR or payroll systems.

Separately, software that has a medical purpose is regulated as a medical device in the UK. The MHRA's guidance on stand-alone software and apps is clear on three points that catch founders out:

• The manufacturer's own description does not settle it. A "not a medical device" disclaimer does not help if medical claims are made or implied elsewhere.
• Simple changes in wording can change the answer, so the intended purpose should be written down deliberately.
• Monitoring general fitness, general health and general wellbeing is not usually considered a medical purpose. Software that influences the actual treatment, such as a dose, is most likely to be a device.

In practice, a symptom diary that stays with the user and a tool that advises on treatment are very different products. If yours might be a device, get regulatory advice early. Magora is not your regulatory advisor. We raise the question in the first fortnight, write the intended-purpose statement with you and build to whichever answer your advisor gives.

If the software is a device, it must be registered with the MHRA before it is placed on the Great Britain market. The UKCA marking is the Great Britain route. CE-marked devices are accepted for a limited time: until 30 June 2028 for devices under the older EU directives, and until 30 June 2030 for devices under the EU MDR, per the MHRA's guidance. The MHRA ran a consultation from 16 February to 10 April 2026 on indefinite recognition of CE-marked devices, and says the existing arrangements stay in place while responses are considered. Check the current position before you plan a CE-only route. For DTAC purposes, a device must also come with a completed pre-acquisition questionnaire (PAQ).

For a wider view on the regulatory side of the build, see our page on healthcare software development in the UK.

What does DTAC ask a supplier for?

DTAC is a single form that brings together the baseline standards a digital health product is expected to meet. It applies alongside, and does not replace, other approvals: a product may still need medical device certification or ICO registration. NHS England reviewed it in 2024. The result is DTAC form version 2.0, last updated on 24 February 2026, with about 25 per cent fewer questions and less overlap with the DSPT and the pre-acquisition questionnaire. From 6 April 2026 manufacturers must provide the new form when a health or care organisation asks for one. Download it at the point of use to get the current version.

The form is completed by the manufacturer. If you sell a product that someone else built, you work with the manufacturer to complete it. It is organised into sections A to D:

A few details from the form are worth knowing before you start:

• Penetration test. Internet-facing products need a summary of an external test from the previous 12 months that covered the OWASP Top 10, with no vulnerability scoring 7.0 or above on CVSS. Signing the NHS Cyber Security Charter for Suppliers lets you skip the remaining C3 questions.
• Cyber Essentials. The form asks for a valid certificate. Certificates last 12 months.
• Accessibility. The form asks whether web and mobile products meet WCAG 2.2 AA, and accepts a plan and timeline if they do not yet.
• Data location. You must say whether data is stored or processed only in the UK, and justify any transfer outside it.

What do DCB0129 and DCB0160 require?

DCB0129 and DCB0160 are the two NHS standards for digital clinical safety. DCB0129 applies to manufacturers, to help them evidence the clinical safety of their products. DCB0160 applies to the health and care organisations that deploy and use the software. NHS England notes that not every digital solution is subject to formal clinical safety assurance, and publishes an applicability tool to help decide. Under DTAC, if your product is designed to provide electronic information that influences, supports or manages the real-time or near real-time direct care of patients, you must either show DCB0129 compliance or justify why you are out of scope. The buyer can challenge that justification.

The Clinical Safety Officer

Both standards require a named Clinical Safety Officer (CSO). NHS England describes the CSO as a senior clinician with a current registration with a professional body such as the GMC or NMC and sufficient training in clinical risk management. The DTAC form adds that the CSO must be knowledgeable in risk management, have enough responsibility to ensure the standard is followed, and may be provided through an outsourced arrangement. The form also states that the earlier requirement for DTAC-specific NHS training no longer applies, though training by a suitable provider remains strongly recommended.

This is a clinical role, not a developer role. At Magora the CSO sits with you or with a specialist we work alongside.

The documents

The clinical risk management work produces a small set of documents that the buyer will ask for:

1. Clinical risk management plan. How you will manage clinical risk for this product.
2. Hazard log. Every hazard identified, its potential clinical impact, mitigations and the final risk assessment. It is the document the rest of the work stands on.
3. Clinical safety case report. A structured argument, supported by evidence, that the system is safe for release. It lists residual risks and any hazards transferred to the deploying organisation.
4. Safety incident log. Maintained for the life of the product, with risks reassessed as they emerge in use.

There is no single NHS-wide scheme for scoring risk in the hazard log. You declare the scheme you used in the safety case report, and each buyer judges it against its own tolerance for risk. Hazard identification methods named in the standards include functional failure analysis, HAZID and structured what-if technique (SWIFT).

This is where engineering and compliance meet. At Magora we keep the hazard log live through the build, so each feature that lands is assessed when it is built rather than reconstructed at the end.

Where the standards are going

NHS England is reviewing both standards. A public consultation ran from 29 June to 11 September 2026. The sources we checked did not show revised standards published, so the current versions remain the reference. Watch the NHS England clinical safety pages for the outcome.

What is the DSPT, and do suppliers need it?

The Data Security and Protection Toolkit is an online self-assessment that measures an organisation against the National Data Guardian's 10 data security standards. NHS England states that all organisations with access to NHS patient data and systems must use it.

For a supplier, three points matter:

• DTAC checks it. If you have direct or remote access to patient data or NHS systems, DTAC asks you to confirm Standards Met or Exceeded for the current year, or the previous year if you have not yet submitted. Assessors validate this against the DSPT database.
• Your organisation type sets the scope. A company with 50 or more staff and turnover of £10 million or more that supplies digital goods or services to the NHS or care selects Supplier. Other companies select Other. The scope is the health and care data you process, not the whole business.
• The 2026-27 version is current. Version 9 of the outcomes, assertions and evidence items was published on 2 October 2026, along with a list of areas of mandatory audit that includes IT suppliers. Read it before you plan your submission.

Cyber Essentials Plus is not mandatory for a DSPT self-assessment, but organisations that hold it do not have to answer some questions. Cyber Essentials Plus is a separate matter from the plain Cyber Essentials certificate that DTAC asks for.

We hold ISO/IEC 27001 certification and align hosting and access controls with the DSPT, but your DSPT submission is your own: it covers your organisation and your data processing.

How does UK GDPR apply to health data?

Health data is special category data under UK GDPR. The ICO defines it as personal data related to the physical or mental health of a person, including the provision of health care services, which reveals information about their health status. It covers specific details of conditions, tests or treatment and any related data that reveals the state of someone's health. Processing it requires you to identify an Article 9 condition as well as a lawful basis. The ICO notes that its guidance is under review following the Data (Use and Access) Act, so check for updates.

In practice DTAC turns this into specific evidence:

• A current ICO registration.
• A DPIA. The form notes that UK GDPR requires one before processing likely to result in high risk, and that most digital health technologies will need one. It should cover the data fields, data flows, security controls, countries involved, sub-processors, retention and how the product supports data subject rights.
• Transparency information the buyer can reuse, and clear, fair terms on use of user data.

The NHS organisation is normally the controller and the supplier a processor. We act as processor under the client's controllership, with a DPIA and data-flow documentation agreed before any record moves, and we host in the UK or EU by default.

What about interoperability and the NICE framework?

DTAC section C4 asks which standards your APIs use and why they are appropriate, pointing suppliers to the NHS England Standards Directory and developer and integration hub. If your product exchanges patient data with national or local systems, it asks whether you can use the NHS number to identify patients and whether you integrate with the Personal Demographics Service. Patient-facing products are asked whether they use NHS login for identity and authentication. The specific standards depend on the system you connect to, which is why we prove the hardest integration in a spike before pricing the build. Our delivery work uses HL7 FHIR R4, HL7 v2 and GP Connect, with SNOMED CT and dm+d for coding.

Alongside DTAC, the NICE Evidence Standards Framework for digital health technologies describes the evidence a product needs, in proportion to its risk. It classifies a product by its intended purpose into tiers A, B and C, and NICE designed it so that most regulated medical devices fall into tier C. The framework was last updated on 9 August 2022, and NHS England says DTAC now aligns its scope with NICE. For a founder, the practical point is that the intended-purpose statement drives the evidence you need as well as the regulatory route.

How long does it take, and what does it cost?

We do not have published figures for the third-party parts, so we will not guess. What can be said is where the time goes:

1. Scoping, in the first weeks. Intended purpose, medical device question, DCB0129 applicability, data flows and hosting location. Cheap to settle now, expensive later.
2. During the build. The hazard log, DPIA and security controls are produced alongside the code.
3. Before launch. The penetration test, the safety case report sign-off by the CSO, and your DSPT submission. These involve other parties, so book them early.
4. After launch. Safety incident log, DPIA and hazard log updates, an annual DSPT return, and a Cyber Essentials certificate that must be renewed every 12 months.

The fees for a Clinical Safety Officer, penetration test, regulatory advice and certification are quoted separately and depend on the supplier. For what we charge for the build itself, see how much healthcare software costs in the UK.

How do you build this in rather than bolt it on?

Compliance is cheaper when it shapes the architecture from the start. The buyer's questions about audit logging, role separation, data residency and failure behaviour are much easier to answer truthfully if the system was designed around them.

• Write the intended purpose in week one. It decides scope, device status and the evidence tier.
• Keep the hazard log live. Review it at the end of every sprint.
• Log and restrict by default. Audit trail on every record, least-privilege access, encryption at rest.
• Keep data in the UK or EU unless there is a documented reason not to.
• Prove integrations early. Access to a real sandbox is often the slowest part.

Examples of how this works in our delivered work: BodySync uses AI to draft treatment plans for clinicians and was built for HIPAA and GDPR. Focalyx holds patient data and treatment outcomes across partner clinics. InnovoCare models care pathway costs for hospital administrators, and Pharm Card serves a pharma sales force. These are not NHS submissions, but they show the discipline of handling regulated data and working with clinicians.

If you are earlier on, the Discovery phase is where we settle intended purpose, integrations and assurance scope, and a free working prototype gets you to a conversation with a buyer sooner.

Frequently asked questions

Is DTAC mandatory to sell to the NHS?

DTAC is the assessment framework that care commissioners and providers use to assure digital health technology, so in practice a buyer will ask for the completed form. It sits alongside other approvals rather than replacing them. Since 6 April 2026 buyers expect version 2.0 of the form.

Do I need DTAC if I only sell to private clinics?

DTAC is written for the NHS and adult social care in England. A private buyer may still ask for it, because it is a recognised baseline for safety, data protection and security. Ask your buyer which evidence they expect.

What is the difference between DCB0129 and DCB0160?

DCB0129 applies to the manufacturer of health IT. DCB0160 applies to the health or care organisation that deploys and uses it. The deploying organisation relies on your DCB0129 documents to do its own work.

Who can be a Clinical Safety Officer?

A suitably qualified and experienced clinician with a current registration with a relevant professional body, such as the GMC or NMC, who understands clinical risk management and has enough responsibility to ensure the standard is followed. The role can be outsourced.

Does my app need to be registered as a medical device?

Only if it has a medical purpose. The MHRA looks at the intended purpose and claims made about the product, not just disclaimers. Monitoring general wellbeing is not usually a medical purpose. If you think yours might qualify, take regulatory advice early.

Do I need a DSPT submission and Cyber Essentials?

If you have access to NHS patient data or systems, yes for the DSPT, and DTAC checks your status. DTAC also asks for a Cyber Essentials certificate or a signed NHS Cyber Security Charter for Suppliers. Cyber Essentials Plus is not required for the DSPT.

Can Magora handle all of this for us?

We produce the DTAC technical responses, maintain the DCB0129 hazard log through the build, host in the UK or EU and align hosting and access controls with the DSPT. The Clinical Safety Officer sits with you or a specialist, and regulatory advice comes from your advisor.

Planning an NHS-facing product? Send us your brief and we will build a free prototype of the core journey, then scope intended purpose, integrations and assurance evidence in Discovery.